Misleading error message when no proper access for docker

[Jelledb]

Hi,

I was struggling yesterday with pulling an image from the GCR registry and I got the following error message multiple times:

Error response from daemon: unauthorized: You don't have the needed permissions to perform this operation, and you may have invalid credentials. To authenticate your request, follow the steps in: https://cloud.google.com/container-registry/docs/advanced-authentication

However, this is not the case, because the problem was actually that my system was not able to run docker without sudo. And with sudo I was not able to use the gcloud CLI.

I used this stackoverflow as a solution: https://stackoverflow.com/questions/48957195/how-to-fix-docker-got-permission-denied-issue/48957722#48957722

Just sending this out here so people in the future won't have the same problem and you might want to change the error message since the problem is not in the authentication of Google Cloud.

[oryband]

What an important note to mention. I think this should be updated in the Googlle Container Registry docs: https://cloud.google.com/sdk/gcloud/reference/auth/configure-docker

[TMWagner]

what OS are you running this from?

[jonjohnsonjr]

However, this is not the case, because the problem was actually that my system was not able to run docker without sudo. And with sudo I was not able to use the gcloud CLI.

I think you could argue that it was the case, because you were acting as the root user, who did not have the needed permissions because you had not configured the root user's credential helper. I'd agree this is confusing, though.

What an important note to mention. I think this should be updated in the Googlle Container Registry docs

The docs on gcr.io mention this: https://cloud.google.com/container-registry/docs/advanced-authentication#:~:text=Note%3A%20If%20you%20normally,auth%20configure-docker%20instead.

[vinay1591]

I am facing this strange issue in one of my GKE cluster. In the same namespace, 2 pods are running for the same application - both the pods are trying to pull the same image but one is able to successfully pull the image and other one is failing with authentication failure -

Error msg is -
rpc error: code = Unknown desc = Error response from daemon: unauthorized: You don't have the needed permissions to perform this operation, and you may have invalid credentials. To authenticate your request, follow the steps in: https://cloud.google.com/container-registry/docs/advanced-authentication
Could somebody help me here?

Also all my other pods in a different namespace are running without any issue.

How is it possible that one pod is running without any issue while other one is not having permissions to pull the image? Why GCR is allowing one pod to pull the same image and not the other pod? If I delete the running pod, it sometimes fails with permissions issue and sometimes not.